Stopping Session Hijacking

Question

If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session hijacking then what I have already. I would like to keep the security measures to my PHP code and not in any of the web server settings.

Here is what I am doing right now:

• When a user logs in, session_regenerate_id() is called
• A session variable is created which stores the users IP address which is decided from HTTP_X_CLUSTER_CLIENT_IP, HTTP_CLIENT_IP, HTTP_FORWARDED, HTTP_FORWARDED_FOR, or REMOTE_ADDR (whichever is found first)

Anyone have any tips on what else I should be doing? I was also wondering what the best method is to determine the users IP address so it can't be spoofed?

Answer 1

First of all remove all of the proposed checks. They are relying upon attacker controlled input to impose security restrictions. Nothing about this is "secure", its just foolish.

Spoofing your IP address over the internet is impossible because of the 3 way handshake, you should try studying networking it is actually pretty interesting. Using the HTTP_FORWARDED_FOR PHP variable for security is a violation of CWE-291: Trusting Self-reported IP address.

So how do you prevent "session hijacking"? Prevent the attacker from obtaining the session id in the first place.

OWASP A9 - Insufficent transport layer protection and OWASP A2- Cross Site Scripting.

Set these PHP session configurations:

session.cookie_httponly = 1 (helps mitigate xss)
session.session.use_only_cookies = 1 (prevents session fixation)
session.entropy_file = "/dev/urandom" (better entropy source)
session.cookie_lifetime = 0  (smaller exploitation window for xss/csrf/clickjacking...)
session.cookie_secure = 1 (owasp a9 violations)